"""
简单获取Falco输出
"""
import pyperclip

# from cbjLibrary import misc
# import fmt_rules
import argparse

# 添加参数
parser = argparse.ArgumentParser()
parser.add_argument('-p', '--copy', action='store_true', help='copy to clipboard')
parser.add_argument('-s', '--silent', action='store_true', help='set manually in python')

# 解析参数
print("""
  /$$$$$$            /$$$$$$  /$$   /$$
 /$$__  $$          /$$__  $$| $$$ | $$
| $$  \__/ /$$$$$$$| $$  \__/| $$$$| $$
| $$      /$$_____/| $$      | $$ $$ $$
| $$     |  $$$$$$ | $$      | $$  $$$$
| $$    $$\____  $$| $$    $$| $$\  $$$
|  $$$$$$//$$$$$$$/|  $$$$$$/| $$ \  $$
 \______/|_______/  \______/ |__/  \__/
                                       
                                       
                                       
""")
args = parser.parse_args()
copyToClipboard = args.copy

tagsMap = {
    'public': True,
    'file': True,
    'syscall': True,
    'network': True,
    'docker': True
}
if not args.silent:
    for tag in tagsMap.items():
        # 抄的代码
        userInput = input(f"{tag[0]}?(y/N)").lower()  # 大写的是默认值
        tagsMap[tag[0]] = True if userInput == 'y' else False


outputDict = {
    'public': [  # 'evt.datetime', 'user_loginuid', 'user.name', # 这段暂时不要, 如果之后与服务器通讯可以需要
        'proc.pid', 'proc.name', 'proc.cmdline', 'proc.ppid', 'proc.pname', 'proc.pcmdline'],
    'file': ['fd.name'],
    'syscall': ['evt.type', 'evt.args'],
    'network': ['fd.name', 'evt.type', 'fd.l4proto', 'fd.cip', 'fd.sip', 'fd.cport', 'fd.sport'],
    'docker': ['container.id', 'container.image']
}

outputList = []
for tag in tagsMap.items():
    if not tag[1]:
        continue
    for i in outputDict[tag[0]]:
        if i not in outputList:
            outputList.append(f"{i}=%{i}")

content = ", ".join(outputList)
output = f"output: detected ({content})"
print(output)
if copyToClipboard:
    pyperclip.copy(output)
